Real privacy policy and terms of use

[mattsodomsky]

The /privacy and /terms pages were ~40-word placeholders explicitly labeled "temporary." App Review requires an accurate privacy policy, and the iOS subscribe UI links to these pages — so they're a launch blocker. This replaces them with real, accurate content.

They're written to match how the system actually handles data (I have the facts from building the encryption + payment + AI plumbing), which is the property that matters most for both Apple and for being honest with users.

Privacy policy covers

• The identity-derived encryption — conversations are encrypted with a key derived from your sign-in, so we can't read them server-side (structural, not just a promise)
• What's collected and why: a one-way hash of the sign-in id (never the raw id), an obscured email only (never the full one), the encrypted narrative, encrypted payment references
• The real subprocessor list: Google/Apple (sign-in), Apple (IAP), Stripe (web pay), Lightward AI (generates responses — processes messages), Fly.io (hosting), Rollbar (error monitoring, excludes conversation content), Fathom (privacy-first analytics)
• What we don't do: no selling, no ads, no ad trackers
• Retention + account deletion (the DELETE /native/account feature), and user rights

Terms of use covers

• What Yours is (AI-generated, not professional advice)
• Eligibility (13+)
• Auto-renewing subscription terms ($10–$100/mo, billed by Apple/Stripe, cancel via storefront) — the Apple-required auto-renewal disclosure
• Acceptable use, account deletion, "as is" warranty, liability limit, governing law

The spec now asserts the load-bearing facts (operator, contact, encryption, auto-renewal) rather than exact prose, so the pages can be edited without breaking the suite. 256 specs, 0 failures. Pages render at /privacy and /terms (verified, 200).

---

👀 Your part — please review, they're your legal documents

• Read both pages and confirm they match your intentions. I wrote them accurately from the technical facts, but I'm not a lawyer — for a product taking payments + handling PII, a quick review by someone qualified is wise, especially if you have EU/California users (GDPR/CCPA add specifics beyond this baseline).
• "Last updated" date — I set July 9, 2026; adjust if needed.
• Governing law — I wrote "the state in which Lightward Inc is organized" without naming it; name the state explicitly if you prefer.
• Confirm the subprocessor list is complete and current (e.g. if Lightward AI's downstream providers should be named).

🤖 Generated with Claude Code